D. Tar Internals

Basic Tar Format

(This message will disappear, once this node revised.)

While an archive may contain many files, the archive itself is a
single ordinary file. Like any other file, an archive file can be
written to a storage device such as a tape or disk, sent through a
pipe or over a network, saved on the active file system, or even
stored in another archive. An archive file is not easy to read or
manipulate without using the tar utility or Tar mode in
GNU Emacs.

Physically, an archive consists of a series of file entries terminated
by an end-of-archive entry, which consists of two 512 blocks of zero
bytes. A file
entry usually describes one of the files in the archive (an
archive member), and consists of a file header and the contents
of the file. File headers contain file names and statistics, checksum
information which tar uses to detect file corruption, and
information about file types.

Archives are permitted to have more than one member with the same
member name. One way this situation can occur is if more than one
version of a file has been stored in the archive. For information
about adding new versions of a file to an archive, see Updating an Archive.

In addition to entries describing archive members, an archive may
contain entries which tar itself uses to store information.
See section Including a Label in the Archive, for an example of such an archive entry.

A tar archive file contains a series of blocks. Each block
contains BLOCKSIZE bytes. Although this format may be thought
of as being on magnetic tape, other media are often used.

Each file archived is represented by a header block which describes
the file, followed by zero or more blocks which give the contents
of the file. At the end of the archive file there are two 512-byte blocks
filled with binary zeros as an end-of-file marker. A reasonable system
should write such end-of-file marker at the end of an archive, but
must not assume that such a block exists when reading an archive. In
particular GNUtar always issues a warning if it does not encounter it.

The blocks may be blocked for physical I/O operations.
Each record of n blocks (where n is set by the
`--blocking-factor=512-size' (`-b 512-size') option to tar) is written with a single
`write ()' operation. On magnetic tapes, the result of
such a write is a single record. When writing an archive,
the last record of blocks should be written at the full size, with
blocks after the zero block containing all zeros. When reading
an archive, a reasonable system should properly handle an archive
whose last record is shorter than the rest, or which contains garbage
records after a zero block.

The header block is defined in C as follows. In the GNUtar
distribution, this is part of file `src/tar.h':

All characters in header blocks are represented by using 8-bit
characters in the local variant of ASCII. Each field within the
structure is contiguous; that is, there is no padding used within
the structure. Each character on the archive medium is stored
contiguously.

Bytes representing the contents of files (after the header block
of each file) are not translated in any way and are not constrained
to represent characters in any character set. The tar format
does not distinguish text files from binary files, and no translation
of file contents is performed.

The name, linkname, magic, uname, and
gname are null-terminated character strings. All other fields
are zero-filled octal numbers in ASCII. Each numeric field of width
w contains w minus 1 digits, and a null.

The name field is the file name of the file, with directory names
(if any) preceding the file name, separated by slashes.

See how big a name before field overflows?

The mode field provides nine bits specifying file permissions
and three bits to specify the Set UID, Set GID, and Save Text
(sticky) modes. Values for these bits are defined above.
When special permissions are required to create a file with a given
mode, and the user restoring files from the archive does not hold such
permissions, the mode bit(s) specifying those special permissions
are ignored. Modes which are not supported by the operating system
restoring files from the archive will be ignored. Unsupported modes
should be faked up when creating or updating an archive; e.g., the
group permission could be copied from the other permission.

The uid and gid fields are the numeric user and group
ID of the file owners, respectively. If the operating system does
not support numeric user or group IDs, these fields should
be ignored.

The size field is the size of the file in bytes; linked files
are archived with this field specified as zero.

The mtime field is the data modification time of the file at
the time it was archived. It is the ASCII representation of the octal
value of the last time the file's contents were modified, represented
as an integer number of
seconds since January 1, 1970, 00:00 Coordinated Universal Time.

The chksum field is the ASCII representation of the octal value
of the simple sum of all bytes in the header block. Each 8-bit
byte in the header is added to an unsigned integer, initialized to
zero, the precision of which shall be no less than seventeen bits.
When calculating the checksum, the chksum field is treated as
if it were all blanks.

The typeflag field specifies the type of file archived. If a
particular implementation does not recognize or permit the specified
type, the file will be extracted as if it were a regular file. As this
action occurs, tar issues a warning to the standard error.

The atime and ctime fields are used in making incremental
backups; they store, respectively, the particular file's access and
status change times.

The offset is used by the `--multi-volume' (`-M') option, when
making a multi-volume archive. The offset is number of bytes into
the file that we need to restart at to continue the file on the next
tape, i.e., where we store the location that a continued file is
continued at.

The following fields were added to deal with sparse files. A file
is sparse if it takes in unallocated blocks which end up being
represented as zeros, i.e., no useful data. A test to see if a file
is sparse is to look at the number blocks allocated for it versus the
number of characters in the file; if there are fewer blocks allocated
for the file than would normally be allocated for a file of that
size, then the file is sparse. This is the method tar uses to
detect a sparse file, and once such a file is detected, it is treated
differently from non-sparse files.

Sparse files are often dbm files, or other database-type files
which have data at some points and emptiness in the greater part of
the file. Such files can appear to be very large when an `ls
-l' is done on them, when in truth, there may be a very small amount
of important data contained in the file. It is thus undesirable
to have tar think that it must back up this entire file, as
great quantities of room are wasted on empty blocks, which can lead
to running out of room on a tape far earlier than is necessary.
Thus, sparse files are dealt with so that these empty blocks are
not written to the tape. Instead, what is written to the tape is a
description, of sorts, of the sparse file: where the holes are, how
big the holes are, and how much data is found at the end of the hole.
This way, the file takes up potentially far less room on the tape,
and when the file is extracted later on, it will look exactly the way
it looked beforehand. The following is a description of the fields
used to handle a sparse file:

The sp is an array of struct sparse. Each struct
sparse contains two 12-character strings which represent an offset
into the file and a number of bytes to be written at that offset.
The offset is absolute, and not relative to the offset in preceding
array element.

The header can hold four of these struct sparse at the moment;
if more are needed, they are not stored in the header.

The isextended flag is set when an extended_header
is needed to deal with a file. Note that this means that this flag
can only be set when dealing with a sparse file, and it is only set
in the event that the description of the file will not fit in the
allotted room for sparse structures in the header. In other words,
an extended_header is needed.

The extended_header structure is used for sparse files which
need more sparse structures than can fit in the header. The header can
fit 4 such structures; if more are needed, the flag isextended
gets set and the next block is an extended_header.

Each extended_header structure contains an array of 21
sparse structures, along with a similar isextended flag
that the header had. There can be an indeterminate number of such
extended_headers to describe a sparse file.

REGTYPE

AREGTYPE

These flags represent a regular file. In order to be compatible
with older versions of tar, a typeflag value of
AREGTYPE should be silently recognized as a regular file.
New archives should be created using REGTYPE. Also, for
backward compatibility, tar treats a regular file whose name
ends with a slash as a directory.

LNKTYPE

This flag represents a file linked to another file, of any type,
previously archived. Such files are identified in Unix by each
file having the same device and inode number. The linked-to name is
specified in the linkname field with a trailing null.

SYMTYPE

This represents a symbolic link to another file. The linked-to name
is specified in the linkname field with a trailing null.

CHRTYPE

BLKTYPE

These represent character special files and block special files
respectively. In this case the devmajor and devminor
fields will contain the major and minor device numbers respectively.
Operating systems may map the device specifications to their own
local specification, or may ignore the entry.

DIRTYPE

This flag specifies a directory or sub-directory. The directory
name in the name field should end with a slash. On systems where
disk allocation is performed on a directory basis, the size field
will contain the maximum number of bytes (which may be rounded to
the nearest disk block allocation unit) which the directory may
hold. A size field of zero indicates no such limiting. Systems
which do not support limiting in this manner should ignore the
size field.

FIFOTYPE

This specifies a FIFO special file. Note that the archiving of a
FIFO file archives the existence of this file and not its contents.

CONTTYPE

This specifies a contiguous file, which is the same as a normal
file except that, in operating systems which support it, all its
space is allocated contiguously on the disk. Operating systems
which do not allow contiguous allocation should silently treat this
type as a normal file.

A … Z

These are reserved for custom implementations. Some of these are
used in the GNU modified format, as described below.

Other values are reserved for specification in future revisions of
the P1003 standard, and should not be used by any tar program.

The magic field indicates that this archive was output in
the P1003 archive format. If this field contains TMAGIC,
the uname and gname fields will contain the ASCII
representation of the owner and group of the file respectively.
If found, the user and group IDs are used rather than the values in
the uid and gid fields.

GNU Extensions to the Archive Format

(This message will disappear, once this node revised.)

The GNU format uses additional file types to describe new types of
files in an archive. These are listed below.

GNUTYPE_DUMPDIR

'D'

This represents a directory and a list of files created by the
`--incremental' (`-G') option. The size field gives the total
size of the associated list of files. Each file name is preceded by
either a `Y' (the file should be in this archive) or an `N'.
(The file is a directory, or is not stored in the archive.) Each file
name is terminated by a null. There is an additional null after the
last file name.

GNUTYPE_MULTIVOL

'M'

This represents a file continued from another volume of a multi-volume
archive created with the `--multi-volume' (`-M') option. The original
type of the file is not given here. The size field gives the
maximum size of this piece of the file (assuming the volume does
not end before the file is written out). The offset field
gives the offset from the beginning of the file where this part of
the file begins. Thus size plus offset should equal
the original size of the file.

GNUTYPE_SPARSE

'S'

This flag indicates that we are dealing with a sparse file. Note
that archiving a sparse file requires special operations to find
holes in the file, which mark the positions of these holes, along
with the number of bytes of data to be found after the hole.

GNUTYPE_VOLHDR

'V'

This file type is used to mark the volume header that was given with
the `--label=archive-label' (`-V archive-label') option when the archive was created. The name
field contains the name given after the `--label=archive-label' (`-V archive-label') option.
The size field is zero. Only the first file in each volume
of an archive should have this type.

You may have trouble reading a GNU format archive on a
non-GNU system if the options `--incremental' (`-G'),
`--multi-volume' (`-M'), `--sparse' (`-S'), or `--label=archive-label' (`-V archive-label') were
used when writing the archive. In general, if tar does not
use the GNU-added fields of the header, other versions of
tar should be able to read the archive. Otherwise, the
tar program will give an error, the most likely one being a
checksum error.

Storing Sparse Files

The notion of sparse file, and the ways of handling it from the point
of view of GNUtar user have been described in detail in
Archiving Sparse Files. This chapter describes the internal format GNUtar
uses to store such files.

The support for sparse files in GNUtar has a long history. The
earliest version featuring this support that I was able to find was 1.09,
released in November, 1990. The format introduced back then is called
old GNU sparse format and in spite of the fact that its design
contained many flaws, it was the only format GNUtar supported
until version 1.14 (May, 2004), which introduced initial support for
sparse archives in PAX archives (see section GNUtar and POSIXtar). This
format was not free from design flaws, either and it was subsequently
improved in versions 1.15.2 (November, 2005) and 1.15.92 (June,
2006).

In addition to GNU sparse format, GNUtar is able to read and
extract sparse files archived by star.

D.0.1 Old GNU Format

The format introduced in November 1990 (v. 1.09) was
designed on top of standard ustar headers in such an
unfortunate way that some of its fields overwrote fields required by
POSIX.

An old GNU sparse header is designated by type `S'
(GNUTYPE_SPARSE) and has the following layout:

Offset

Size

Name

Data type

Contents

0

345

N/A

Not used.

345

12

atime

Number

atime of the file.

357

12

ctime

Number

ctime of the file .

369

12

offset

Number

For
multivolume archives: the offset of the start of this volume.

381

4

N/A

Not used.

385

1

N/A

Not used.

386

96

sp

sparse_header

(4 entries) File map.

482

1

isextended

Bool

1 if an
extension sparse header follows, 0 otherwise.

483

12

realsize

Number

Real size of the file.

Each of sparse_header object at offset 386 describes a single
data chunk. It has the following structure:

Offset

Size

Data type

Contents

0

12

Number

Offset of the
beginning of the chunk.

12

12

Number

Size of the chunk.

If the member contains more than four chunks, the isextended
field of the header has the value 1 and the main header is
followed by one or more extension headers. Each such header has
the following structure:

D.0.2 PAX Format, Versions 0.0 and 0.1

There are two formats available in this branch. The version 0.0
is the initial version of sparse format used by tar
versions 1.14-1.15.1. The sparse file map is kept in extended
(x) PAX header variables:

GNU.sparse.size

Real size of the stored file;

GNU.sparse.numblocks

Number of blocks in the sparse map;

GNU.sparse.offset

Offset of the data block;

GNU.sparse.numbytes

Size of the data block.

The latter two variables repeat for each data block, so the overall
structure is like this:

Whereas the POSIX specification allows a variable to appear multiple
times in a header, it requires that only the last occurrence be
meaningful. Thus, multiple occurrences of GNU.sparse.offset and
GNU.sparse.numbytes are conflicting with the POSIX specs.

Attempting to extract such archives using a third-party's tar
results in extraction of sparse files in condensed form. If
the tar implementation in question does not support POSIX
format, it will also extract a file containing extension header
attributes. This file can be used to expand the file to its original
state. However, posix-aware tars will usually ignore the
unknown variables, which makes restoring the file more
difficult. See Extraction of sparse members in v.0.0 format, for the detailed description of how to
restore such members using non-GNU tars.

GNUtar 1.15.2 introduced sparse format version 0.1, which
attempted to solve these problems. As its predecessor, this format
stores sparse map in the extended POSIX header. It retains
GNU.sparse.size and GNU.sparse.numblocks variables, but
instead of GNU.sparse.offset/GNU.sparse.numbytes pairs
it uses a single variable:

GNU.sparse.map

Map of non-null data chunks. It is a string consisting of
comma-separated values "offset,size[,offset-1,size-1...]"

To address the 2nd problem, the name field in ustar
is replaced with a special name, constructed using the following pattern:

%d/GNUSparseFile.%p/%f

The real name of the sparse file is stored in the variable
GNU.sparse.name. Thus, those tar implementations
that are not aware of GNU extensions will at least extract the files
into separate directories, giving the user a possibility to expand it
afterwards. See Extraction of sparse members in v.0.1 format, for the detailed description of how to
restore such members using non-GNU tars.

The resulting GNU.sparse.map string can be very long.
Although POSIX does not impose any limit on the length of a x
header variable, this possibly can confuse some tars.

D.0.3 PAX Format, Version 1.0

The version 1.0 of sparse format was introduced with GNUtar
1.15.92. Its main objective was to make the resulting file
extractable with little effort even by non-posix aware tar
implementations. Starting from this version, the extended header
preceding a sparse member always contains the following variables that
identify the format being used:

GNU.sparse.major

Major version

GNU.sparse.minor

Minor version

The name field in ustar header contains a special name,
constructed using the following pattern:

%d/GNUSparseFile.%p/%f

The real name of the sparse file is stored in the variable
GNU.sparse.name. The real size of the file is stored in the
variable GNU.sparse.realsize.

The sparse map itself is stored in the file data block, preceding the actual
file data. It consists of a series of octal numbers of arbitrary length, delimited
by newlines. The map is padded with nulls to the nearest block boundary.

The first number gives the number of entries in the map. Following are map entries,
each one consisting of two numbers giving the offset and size of the
data block it describes.

The format is designed in such a way that non-posix aware tars and tars not
supporting GNU.sparse.* keywords will extract each sparse file
in its condensed form with the file map prepended and will place it
into a separate directory. Then, using a simple program it would be
possible to expand the file to its original form even without GNUtar.
See section Extracting Sparse Members, for the detailed information on how to extract
sparse members without GNUtar.

Format of the Incremental Snapshot Files

A snapshot file (or directory file) is created during
incremental backups (see section Using tar to Perform Incremental Dumps). It
contains the status of the file system at the time of the dump and is
used to determine which files were modified since the last backup.

GNUtar version 1.28 supports three snapshot file
formats. The first format, called format 0, is the one used by
GNUtar versions up to and including 1.15.1. The second format, called
format 1 is an extended version of this format, that contains more
metadata and allows for further extensions. It was used by alpha release
version 1.15.90. For alpha version 1.15.91 and stable releases
version 1.16 up through 1.28, the format 2 is used.

GNUtar is able to read all three formats, but will create
snapshots only in format 2.

This appendix describes all three formats in detail.

`Format 0' snapshot file begins with a line containing a
decimal number that represents a UNIX timestamp of the
beginning of the last archivation. This line is followed by directory
metadata descriptions, one per line. Each description has the
following format:

[nfs]devinodename

where:

nfs

A single plus character (`+'), if this directory is located on
an NFS-mounted partition, otherwise empty.

(That is, for non-NFS directories, the first character on the
description line contains the start of the dev field.)

dev

Device number of the directory;

inode

I-node number of the directory;

name

Name of the directory. Any special characters (white-space,
backslashes, etc.) are quoted.

`Format 1' snapshot file begins with a line specifying the
format of the file. This line has the following structure:

`GNU tar-'tar-version`-'incr-format-version

where tar-version is the version number of GNUtar
implementation that created this snapshot, and
incr-format-version is the version number of the snapshot format
(in this case `1').

Next line contains two decimal numbers, representing the
time of the last backup. First number is the number of seconds, the
second one is the number of nanoseconds, since the beginning of the
epoch.

Lines that follow contain directory metadata, one line per
directory. Each line is formatted as follows:

[nfs]mtime-secmtime-nsecdevinodename

where mtime-sec and mtime-nsec represent last
modification time of this directory with nanosecond precision;
nfs, dev, inode and name have the same meaning
as with `format 0'.

`Format 2' snapshot file begins with a format identifier, as described for
version 1, e.g.:

GNU tar-1.28-2

This line is followed by newline. Rest of file consists of
records, separated by null (ASCII 0)
characters. Thus, in contrast to the previous formats, format 2
snapshot is a binary file.

First two records are decimal integers, representing the
time of the last backup. First number is the number of seconds, the
second one is the number of nanoseconds, since the beginning of the
epoch. These are followed by arbitrary number of directory records.

Each directory record contains a set of metadata describing a
particular directory. Parts of a directory record are delimited with
ASCII 0 characters. The following table describes each
part. The Number type in this table stands for a decimal integer
in ASCII notation. (Negative values are preceeded with a "-"
character, while positive values have no leading punctuation.)

Field

Type

Description

nfs

Character

`1' if the directory is located on
an NFS-mounted partition, or `0' otherwise;

timestamp_sec

Number

Modification time, seconds;

timestamp_nsec

Number

Modification time, nanoseconds;

dev

Number

Device number;

ino

Number

I-node number;

name

String

Directory name; in contrast to the
previous versions it is not quoted;

contents

Dumpdir

Contents of the directory;
See section Dumpdir, for a description of its format.

The specific range of values allowed in each of the Number fields
depends on the underlying C datatypes as determined when tar
is compiled. To see the specific ranges allowed for a particular
tar binary, you can use the
`--show-snapshot-field-ranges' option:

Dumpdir

Incremental archives keep information about contents of each
dumped directory in special data blocks called dumpdirs.

Dumpdir is a sequence of entries of the following form:

Cfilename \0

where C is one of the control codes described below,
filename is the name of the file C operates upon, and
`\0' represents a nul character (ASCII 0). The white space
characters were added for readability, real dumpdirs do not contain
them.

Each dumpdir ends with a single nul character.

The following table describes control codes and their meanings:

`Y'

filename is contained in the archive.

`N'

filename was present in the directory at the time the archive
was made, yet it was not dumped to the archive, because it had not
changed since the last backup.

`D'

filename is a directory.

`R'

This code requests renaming of the filename to the name
specified with the `T' command, that immediately follows it.

`T'

Specify target file name for `R' command (see below).

`X'

Specify temporary directory name for a rename operation (see below).

Codes `Y', `N' and `D' require filename argument
to be a relative file name to the directory this dumpdir describes,
whereas codes `R', `T' and `X' require their argument
to be an absolute file name.

The three codes `R', `T' and `X' specify a
renaming operation. In the simplest case it is:

R`source'\0T`dest'\0

which means "rename file `source' to file `dest'".

However, there are cases that require using a temporary
directory. For example, consider the following scenario:

Previous run dumped a directory `foo' which contained the
following three directories:

a
b
c

They were renamed cyclically, so that:

`a' became `b'`b' became `c'`c' became `a'

New incremental dump was made.

This case cannot be handled by three successive renames, since
renaming `a' to `b' will destroy the existing directory.
To correctly process it, GNUtar needs a temporary directory, so
it creates the following dumpdir (newlines have been added for
readability):

Xfoo\0
Rfoo/a\0T\0
Rfoo/b\0Tfoo/c\0
Rfoo/c\0Tfoo/a\0
R\0Tfoo/a\0

The first command, `Xfoo\0', instructs the extractor to create a
temporary directory in the directory `foo'. Second command,
`Rfoo/aT\0', says "rename file `foo/a' to the temporary
directory that has just been created" (empty file name after a
command means use temporary directory). Third and fourth commands
work as usual, and, finally, the last command, `R\0Tfoo/a\0'
tells tar to rename the temporary directory to `foo/a'.